cms.verify_message should validate the value of Received-Content-MIC for unsigned sent files or fail when MIC is missing.

[adiroiban]

When validating a MDN, the current code only checks for a valid signature.

But I think that it should also read the Received-Content-MIC value and make sure it is the expected value.

Also, I think that the docstring has a copy/paste error.

def verify_message(data_to_verify, signature, verify_cert):
    """Function parses an ASN.1 encrypted message and extracts/decrypts the original message.

I guess that the verify_message arguments should be extended to also pass the expected MIC value.

Thanks!

[abhishek-ram]

Yes indeed the doc string is copy pasted, my bad :)
The validation of the mic happens in Mdn.parse

[adiroiban]

Thanks for your comment regarding MIC validaion.

But there are still a few cases in which the MIC is not validated.

---

If for example the MDN does not contains the MIC header, the AS2 GUI shows a green message: Message has been successfully send to Partner.

RReceived-Content-MIC: //YQQNyuwhG5rPAFDvjPK832wCI=, sha1
Disposition: automatic-action/MDN-sent-automatically; processed

---

Also, when sending a plain file, without signature, but requesting a signed MDN, the MIC is also not checked since I guess the orig_message.mic does not have a MIC.